Wednesday, January 19, 2011

Plugins unplugged

For those of you who use Classilla on OS 9, you already know that Classilla allows you to turn plugins off, and in fact encourages it. It makes the browser more secure by not exposing old unmaintained native code, and it makes the browser more stable by not exposing old unmaintained broken code. If you really really really want to use Flash Player 7 to view something, or QT 6.0.3, you can, but you can turn it right back off again. When I am in OS 9, I just keep plugins off entirely. Plugin support for OS 9 has obviously not been updated in years.

The time is now coming for this state on PowerPC. Adobe has been making noises about ending PPC support for the Flash Player plugin for some time now, and their preliminary system requirements page for Flash Player 10.2, which is now in release candidate stage, finally makes this plain: PowerPC is no longer a supported platform for Flash, although they still support Tiger on Intel. When you download Flash 10.2, it's x86 or bust, similar to their dropping PowerPC from AIR support with 2.0.

Most of us know that Flash was never well-optimized for PowerPC anyway. Even on a fast G5 it chugs, and you can forget about full-screen or HD playback on G4s, let alone G3 systems. Losing Flash is not going to be a massive issue for functionality for awhile because much of the advanced functionality 10.2 introduces will not be widely adopted until 10.2 is. However, it is going to be an issue for security. Flash is a large potential and practical security hole, and while many of the exploits fortunately rely on x86 native code, some do not. Moreover, Flash-based privacy intrusions, while not bugs or security holes per se, have for a long time approached infamy in quantity and ubiquity. While my insiders tell me that Flash 10.2 is light-years ahead of 10.1 in performance, that certainly does not help us on our minority soon-to-be-unsupported architecture.

While Flashblock (at least until beta 9 ... fix it!) helped to block most Flash applets, and tools like AdBlock and NoScript can also serve in this capacity, the time is coming where TenFourFox will go the way of Classilla and block Flash and other plugins at the layout level. This has obvious benefits for security and performance, at the cost of losing Flash. Steve Jobs, bless him, was right to say that HTML5 supersedes many of the features Flash has long been (ab)used for -- not all, but many -- and I think that if we deal with this pain now, we will be better able to adapt. More to the point, Mozilla is moving towards plugin and graphics NPAPI models that no longer use QuickDraw (deprecated since 10.4, and almost certainly further marginalized in 10.7), and this will be an issue for 10.4 which lacks CoreAnimation. In the future it may not be technically possible to still use Mozilla's code base and maintain compatibility with the aging plugin base on PowerPC and Tiger, let alone the attendant disadvantages of continuing to use those plugins.

This post is more of a warning rather than an announcement. While I plan to ship TenFourFox 4.0 with plugin support, albeit deprecated, likely by 10.4Fx "4.1" plugins will be pref-ed off requiring you to manually re-enable them through about:config. At some point in the future when it is no longer technically feasible to support them, that code will be completely removed. Hopefully by then the impact of iOS will have introduced a world where Flash-free alternatives that are natively supported by TenFourFox and Gecko 2.0 are easily accessible.

I'm unfortunately painfully aware there are some apps that won't abandon Flash, but at some point it will no longer be technically feasible to continue supporting it. That's why I wanted to get this out now so that people are aware of it. It will also appear in the release notes.

Moreover, I suspect that for those apps using Flash as a DRM layer, they will drop support for 10.1 after a fashion in any case.

It's not just CoreAnimation, though that is a problem; it's that the plugins themselves are shortly no longer to be updated (first Flash, and undoubtedly QuickTime 7 PPC when OS X Lion emerges). Mozilla is already having trouble with this: see QuickDraw plugins and 10.6 in Bugzilla, there's quite a few entries.

That said, there are some reports that the Firefox sources are buildable on 10.5 PPC finally. I have not tested this; I only run 10.4 except for a lonely 10.5 Intel mini I use for Android work. The builds I am told work fine, and support plugins fully, but this doesn't address the support option. For Flash this is particularly acute. El Furbe was doing some of these builds, and his site is easy to find. If plugins are a big deal to you and you run 10.5, you might look into his builds for as long as he continues to maintain them. They are strictly built from Mozilla source, and do not include any of the other features I'm introducing to TenFourFox such as JavaScript acceleration, but they may do the job for you.

I should make two things (more) plain, also:

- I use 10.4 on a G5 as my primary desktop Mac. I want to support 10.5 and I make as much effort as I can to make sure that 10.5 support is the same as 10.4, but there will be no 10.5-specific features in TenFourFox because I don't run 10.5 and can't maintain them.

- PLUGINS ARE ONLY DEPRECATED, NOT ELIMINATED. Even when I pref them off, the code will still be there and they can be preffed back on until it breaks completely.

For as long as the 4.0 branch of TenFourFox is in maintenance, which will be at least through the next version "4.1," albeit on lifesupport, plugins will be enabled by default and will run by default.

Hi, thanks for the update. Right now, I can play 360p on youtube with TenFourFox for my iBook G4. I use Flashblock and find it a wonderful help. Prior to discovering your browser, I was using Safari and that was much choppier while streaming Flash. With TenFourFox 5,what effect will disabling Flash have for people like me who mainly watch videos? I understand Flash can be turned back on but you'll be discouraging people from even watching, say, Youtube? Thank you.